Malicious PDF — malware analysis report

Static analysis result for SHA-256 44cb273cbc5fd553…

MALICIOUS

PDF

39.6 KB Authoring application: QPDF First seen: 2021-02-19
MD5: 7bc043afabb53a197efa09c825ad24e1 SHA-1: 3ef659f5604b383132c87e577b24848960b7e8a0 SHA-256: 44cb273cbc5fd553a92bb05f269ce7538aac2bafd0007a72ad51d07c995cf9d9
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brokestar.com/uploads/2020/01/28/minumunorajezez.pdf In PDF document text
    • http://nickdejesuslpc.org/uploads/1/3/0/6/130621548/9866670.pdfIn PDF document text
    • http://daygameinthebronx.com/uploads/1/3/0/4/130477945/vawosoxegiv.pdfIn PDF document text
    • http://philadelphiaprek.com/uploads/1/3/0/6/130604315/nusumezebi.pdfIn PDF document text
    • http://mezslimes.co.uk/uploads/1/3/0/6/130605420/buxova_tivedijilal.pdfIn PDF document text
    • http://lincolnspencer.info/uploads/1/3/0/7/130738825/e4bc64cea628.pdfIn PDF document text
    • http://missgabrielsclass.weebly.com/uploads/1/3/0/3/130379121/4205155.pdfIn PDF document text
    • http://ohiobiplanes.com/uploads/1/3/0/4/130489669/6144ed28a3c6.pdfIn PDF document text
    • http://christianambulancenetwork.com/uploads/1/3/0/5/130544889/09ee57d530.pdfIn PDF document text
    • http://bewellmindset.net/uploads/1/3/0/6/130604091/2957135.pdfIn PDF document text
    • http://inscienceitrust.net/uploads/1/3/0/5/130543346/d70d16f1819869c.pdfIn PDF document text
    • http://anotherplacecalledhome.net/uploads/1/3/0/4/130477110/130477110.html#benzene+and+bromine+water+chemguideIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12AF 8348 bytes
SHA-256: 533a44881898632bdc23ee181320db3f7d49a9753f664ef664a7d3e9bd839db9

Open this report in the interactive analyzer, or submit your own file for analysis.